Bypass Record
BYOVD (Vulnerable Driver) × Zemana AntiMalware
A publicly-reported instance of BYOVD (Vulnerable Driver) bypassing Zemana AntiMalware, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The driver fails to set an appropriate security descriptor on its device object, allowing any user to communicate with it. After registering via IOCTL 0x80002010, an attacker can use IOCTL 0x8000204C to obtain a handle to a privileged process for code injection, or use IOCTLs 0x80002014/0x80002018 to perform arbitrary SCSI read/write operations on the disk.
Detection & mitigation
Monitor for the loading of known vulnerable drivers like zamguard64.sys or zam64.sys using Sysmon Event ID 6 (driver loaded) or EDR telemetry, and block them via Windows Defender Application Control (WDAC) or vulnerable driver blocklist policies. Ensure endpoint protection platforms flag or prevent IOCTL communication with such drivers.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.